| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Issue summary: QUIC, when performing automated peer detection, may allow
uninitialized stack data to leak into the received address which is then used
as the destination for outgoing packets.
Impact summary: Applications using QUIC's automated peer detection mechanism
may receive an invalid address, leading to connection loss and disclosure of
uninitialized stack data to an attacker observing the outgoing network traffic.
CWE: CWE-457 (Use of Uninitialized Variable)
Description: The OpenSSL QUIC stack contains a feature in which, when using an
already connected socket, it will auto-detect the peer address during the SSL
handshake. This feature uses the getpeername() function, passing a buffer of
sufficient length to hold any supported address family, but passes a buffer
length that is only sized such that larger addresses, such as IPv6, cannot be
retrieved. The getpeername() function however, still returns the full address
length, which is accepted as the valid input buffer length, leading to the
address buffer containing uninitialized stack data instead of the actual peer
address. The invalid peer address is then used as destination for the outgoing
packets which leads to a connectivity breakage and a leakage of the
uninitialized stack data to passive network observers.
FIPS impact: no
The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as
the affected protocol is not implemented in the FIPS module. |
| Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network. |
| Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code locally. |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| Use after free in Remote Desktop Gateway Service allows an authorized attacker to execute code locally. |
| Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. |
| Server-side request forgery (ssrf) in Microsoft 365 Agents SDK allows an authorized attacker to disclose information over a network. |
| Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network. |
| Authorization bypass through user-controlled key in Microsoft MCP Gateway allows an authorized attacker to elevate privileges over a network. |
| Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
| Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over an adjacent network. |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
| Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disclose information locally. |
| Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network. |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
| In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: propagate shared-frag marker in skb_zerocopy()
skb_zerocopy() moves frag descriptors from @from into @to and takes a
reference on each frag, but it does not copy skb_shinfo(from)->flags into
skb_shinfo(to)->flags. A destination skb holding the same page-cache
backed frags as the source therefore reports skb_has_shared_frag() as
false.
That breaks the invariant relied on by later in-place writers. ESP input
checks skb_has_shared_frag() before deciding whether an uncloned
nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that
skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is
decrypted in place, letting an unprivileged user write into the page
cache of a root-owned read-only file.
Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for
the other frag-transfer helpers. |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. |
